{"id":1438,"date":"2025-06-07T13:04:47","date_gmt":"2025-06-07T17:04:47","guid":{"rendered":"https:\/\/servitiq.ca\/?p=1438"},"modified":"2026-03-13T11:20:23","modified_gmt":"2026-03-13T15:20:23","slug":"cyber-insurance-12-essential-controls-quebec-smb","status":"publish","type":"post","link":"https:\/\/servitiq.ca\/en\/articles\/cyberassurance-pme-quebec-12-controles-essentiels\/","title":{"rendered":"Cybersecurity & Insurers: 12 essential controls for an SMB in Quebec"},"content":{"rendered":"

La Cyber insurance<\/strong> has become one of the financial safeguards for SMBs. Problem: insurers are increasingly refusing applications without minimum controls<\/strong>. Here are the 12 measures that often make the difference between an accepted quote and a denial.<\/p>\n\n\n\n

1) MFA everywhere<\/h2>\n\n\n\n
    \n
  • Enable two-factor authentication<\/strong> on email, VPNs, admin consoles (Microsoft 365\/Google Workspace, firewalls, routers, backups). FIDO2 tokens are a plus.<\/li>\n<\/ul>\n\n\n\n

    2) EDR or MDR<\/h2>\n\n\n\n

    An EDR<\/strong> protects and isolates endpoints; an MDR<\/strong> adds a SOC 24\/7<\/strong> for detection and response. Insurers prefer MDR<\/strong> to reduce response time<\/strong>.<\/p>\n\n\n\n

    3) 3-2-1-1-0 backups<\/h2>\n\n\n\n

    Three copies, two media types, one offsite, one immutable<\/strong>, zero restore errors. Test monthly<\/strong> restores (samples) and quarterly<\/strong> the BCDR plan.<\/p>\n\n\n\n

    4) Patch management<\/h2>\n\n\n\n

    Automate system patches<\/strong> (Windows\/Linux\/Mac), VPN drivers, browsers, and software. Set an SLA<\/strong> : critical patches in < 7 days.<\/p>\n\n\n\n

      <\/ul>\n\n\n\n

      5) Hardening & least privilege<\/h2>\n\n\n\n

      Disable SMBv1\/obsolete SSL, apply password policies<\/strong>, remove inactive accounts<\/strong>, separate admin<\/strong> and user<\/strong>.<\/p>\n\n\n\n

      6) Network segmentation<\/h2>\n\n\n\n

      Isolate servers, workstations, IoT, guests. VLANs<\/strong> + ACLs + separate Wi-Fi. Less impact in case of an incident.<\/p>\n\n\n\n

      7) DNS & email filtering<\/h2>\n\n\n\n

      Secure DNS (malware\/phishing blocking), SPF\/DKIM\/DMARC<\/strong> in quarantine\/reject<\/strong> to limit spoofing.<\/p>\n\n\n\n

      8) Centralized logging<\/h2>\n\n\n\n

      Retain logs<\/strong> (firewall, EDR, AD, M365\/GWS) 90 days minimum. Alerts on admin logins, abnormal failures, account creations.<\/p>\n\n\n\n

      9) Anti-phishing training<\/h2>\n\n\n\n

      Short quarterly modules + simulations. Measure the click rate<\/strong> and target at-risk teams.<\/p>\n\n\n\n

      10) Third-party management<\/h2>\n\n\n\n

      Vendor access reduced and tracked<\/strong> (individual accounts, expiration, MFA). Contractual security clauses.<\/p>\n\n\n\n

      11) IR (Incident Response) plan<\/h2>\n\n\n\n

      Who decides, who communicates, who isolates? Runbooks<\/strong> per scenario (ransomware, compromised email). Tabletop exercises<\/strong> 2\u00d7\/year.<\/p>\n\n\n\n

      12) Governance<\/h2>\n\n\n\n

      An security owner<\/strong> (internal\/MSP), with policies<\/strong> that are concise and living (access, backups, classification, mobility).<\/p>\n\n\n\n

        <\/ul>","protected":false},"excerpt":{"rendered":"

        La cyberassurance est devenue l\u2019un des garde-fous financiers pour les PME. Probl\u00e8me : les assureurs refusent de plus en plus les dossiers sans contr\u00f4les minimaux. Voici les 12 mesures qui font souvent la diff\u00e9rence entre un devis accept\u00e9 et un refus. 1) MFA partout 2) EDR ou MDR Un EDR prot\u00e8ge et isole les postes […]<\/p>\n","protected":false},"author":1,"featured_media":1441,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_swpsp_post_exclude":false,"footnotes":""},"categories":[14],"tags":[],"class_list":["post-1438","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-gouvernance-conformite"],"_links":{"self":[{"href":"https:\/\/servitiq.ca\/en\/wp-json\/wp\/v2\/posts\/1438","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/servitiq.ca\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/servitiq.ca\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/servitiq.ca\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/servitiq.ca\/en\/wp-json\/wp\/v2\/comments?post=1438"}],"version-history":[{"count":7,"href":"https:\/\/servitiq.ca\/en\/wp-json\/wp\/v2\/posts\/1438\/revisions"}],"predecessor-version":[{"id":1736,"href":"https:\/\/servitiq.ca\/en\/wp-json\/wp\/v2\/posts\/1438\/revisions\/1736"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/servitiq.ca\/en\/wp-json\/wp\/v2\/media\/1441"}],"wp:attachment":[{"href":"https:\/\/servitiq.ca\/en\/wp-json\/wp\/v2\/media?parent=1438"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/servitiq.ca\/en\/wp-json\/wp\/v2\/categories?post=1438"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/servitiq.ca\/en\/wp-json\/wp\/v2\/tags?post=1438"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}